opendatahub-operator/.gitleaks.toml at main · opendatahub-io/opendatahub-operator · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
# Gitleaks configuration for opendatahub-io repos
# Synced from security-config. Do not edit in target repos.
#
# Path allowlists use Go regex syntax.
# Real credentials should NEVER be committed to any repository.

[extend]
  useDefault = true

[allowlist]
  description = "Exclude test fixtures, mock data, sample configs, and CI resources"
  paths = [
    # Go testdata directories
    '''testdata/''',

    # Python test data directories
    '''test_data/''',

    # Test fixtures
    '''fixtures/''',

    # JavaScript/TypeScript mocks
    '''__mocks__/''',

    # Go/Java/TS mock directories
    '''mocks/''',
    '''k8mocks/''',

    # Sample and example configs with placeholder credentials
    '''docs/samples/''',
    '''config/samples/''',
    '''config/overlays/test/''',

    # CI/GitHub Actions test resources
    '''\.github/resources/''',

    # E2E test credentials
    '''test/e2e/credentials/''',
    '''tests/e2e/credentials/''',

    # OpenShift CI sample resources
    '''openshift-ci/resources/samples/''',

    # Cypress test data
    '''cypress/fixtures/''',
    '''cypress/tests/mocked/''',

    # Test certificate and key files
    '''tests/data/.*\.(pem|crt|key)$''',
  ]

  # Known test/placeholder credentials used in documentation and tests
  regexes = [
    '''database-password\s*:\s*"?(The)?BlurstOfTimes"?''',
    '''database-user\s*:\s*"?mlmduser"?''',
    '''database-user\s*:\s*"?modelregistryuser"?''',
  ]